How to know if a ".exe" process was written with C++ or C#?

Question

Possible Duplicate:
How do I tell if a win32 application uses the .NET runtime

There is a way to manually recognize if a specific ".exe" process was written with C++(unmanaged code) or with C#(managed code)?

Solution 1

If you're trying to determine if a process is a .NET process, I can suggest a solution inspired from Dave Van den Eynde's answer in this topic: How do I tell if a win32 application uses the .NET runtime

"An application is a .NET executable if it requires mscoree.dll to run.".

Given that, you check the process' modules to see if mscoree is listed.

        foreach (var process in Process.GetProcesses())
        {
            if (process.Modules.OfType<ProcessModule>().Any(m => m.ModuleName.Equals("mscoree.dll", StringComparison.OrdinalIgnoreCase)))
            {
                Console.WriteLine("{0} is a .NET process", process.ProcessName);
            }
        }

Solution 2

Here you can find details how it can be done: Determining Whether a DLL or EXE Is a Managed Component

Solution 3

You can run peverify or ildasm (available from the Visual Studio Command Line environment) on the file and it will give you an error if it's not managed code. Note that this will fail in some cases where they use a protection system that encrypts the IL and hides the CLR bootloader, but most programs don't have this protection.

Solution 4

If it's a .NET .exe (or .dll for that matter), it will have a dependency on mscoree.dll which you can see by examining it with Dependency Walker or something similar.

If you want to do so programatically, you could take this VB project as a starting point.

This won't tell you the language for sure though. You can't tell a C# from a VB.NET (or other .NET language) program or a C++ from a C program (or other non .NET language). There are some things that can rule one or the other out as being the only language used, or make one or the other more likely. There could even be unmanaged code making use of mscoree.dll in some weird way.

View more solutions

Comments

[Kevin Gosse]

I can already say that there is a way, since Process Explorer does that. Now we have to find how :p

[jp2code]

Try hitting the exe with [Reflector][1] to see what turns up. [1]: stackoverflow.com/questions/214764/…

[C.Evenhuis]

Note that programs written in VB.NET generate the same "type" of executable as those written in C#, and you can only guess what was used to create the unmanaged application. As the others mentioned, you can distinguish unmanaged from managed code.

[shraysalvi]

By writing your own code or using other tools ?

[Lynn Crumbling]

Are you looking to do this programmatically or as a manual operation?

[John Dibling]

I don't know, so this is not an answer. Is it possible to check the dependancies? I would guess if there are .NET runtime dependancies, then it must be C#?

[Nawaz]

.NET executables are usually big :P

[BlueRaja - Danny Pflughoeft]

Duplicate of How do I tell if a win32 application uses the .NET runtime, How to check if program is using .net, How do I determine if a process is managed, Identifying a process or module as managed/native

[Diogo]

Does "mscoree.dll" is the main dll resource of a C# managed code binnary? Can I trust that there is no C++ binary that uses the same dll?

[Kevin Gosse]

It is not a managed library, but everything in this dll is related to the .NET Framework. It does not guarantee that the process is a pure .NET application, but at the very least it's hosting some .NET code. For instance, if you load a .NET add-in in Microsoft Word, this dll will appear in the modules, even though Word isn't a .NET application by itself.

[dragonfly02]

Why a console app written in C# doesn't show as a managed app when using this way to check?

[dragonfly02]

While this is a good answer but comparing string using == can be misleading because some process module name is MSCOREE.DLL. Changing == to m.ModuleName.Equals("mscoree.dll", StringComparison.InvariantCultureIgnoreCase) is a safer choice.

[Kevin Gosse]

@stt106 Good point, thanks. I've edited the answer

[SoLaR]

your example code it self is .Net c# and is using mscoree.dll, also if it is using COM that is written in .Net will also load mscoree.dll, etc... Only way I see is to examine process image and check if PE IMAGE HEADER and has IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR descriptor set. see answer from HABJAN

[SoLaR]

Link describes proper way